CVEs published April 25, 2026
40 CVEs were published on April 25, 2026: 3 critical, 10 high.
- Published
- 40
- Critical
- 3
- High
- 10
- Medium
- 24
- Low
- 0
- Unrated
- 3
- Now in CISA KEV
- 0
- Fix available
- 18
Most affected products
- Linux
- 13
- BDCOM P3310D
- 4
- Cesanta Mongoose
- 2
- Datacom DM4100
- 2
- AstrBotDevs AstrBot · astrbot
- 1
- BIVOCOM TR321
- 1
- colinhacks Zod
- 1
- devlikeapro WAHA
- 1
- Divyanshu-hash GitPilot-MCP
- 1
- Envoy
- 1
Critical 3
- CVE-2026-31685netfilter: ip6t_eui64: reject invalid MAC header for all packetsLinux
- CVE-2026-31682bridge: br_nd_send: linearize skb before parsing ND optionsLinux
- CVE-2026-6951Versions of the package simple-git before 3.36.0 are vulnerable to Remote Code Execution (RCE) due to an incomplete fix for [CVE-2022-25912]simple-git · org.webjars.npm:simple-git
High 10
- CVE-2026-6992Linksys MR9600 JNAP Action run_central2.sh BTRequestGetSmartConnectStatus os command injectionLinksys MR9600
- CVE-2026-6988Tenda HG10 Boa Service formRouting formRoute buffer overflowTenda HG10
- CVE-2026-31683batman-adv: avoid OGM aggregation when skb tailroom is insufficientLinux
- CVE-2026-31680net: ipv6: flowlabel: defer exclusive option free until RCU teardownLinux
- CVE-2026-31679openvswitch: validate MPLS set/set_masked payload lengthLinux
- CVE-2026-31678openvswitch: defer tunnel netdev_put to RCU releaseLinux
- CVE-2026-31676rxrpc: only handle RESPONSE during service challengeLinux
- CVE-2026-31675net/sched: sch_netem: fix out-of-bounds access in packet corruptionLinux
- CVE-2026-31674netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check()Linux
- CVE-2026-31673af_unix: read UNIX_DIAG_VFS data under unix_state_lockLinux
Medium, low and unrated 27
- CVE-2026-7002KLiK SocialMediaWebsite Private Message get_message_ajax.php sql injectionKLiK SocialMediaWebsite
- CVE-2026-7001Datacom DM4100 Ethernet Configuration cross site scriptingDatacom DM4100
- CVE-2026-7000Datacom DM4100 VLAN Page cross site scriptingDatacom DM4100
- CVE-2026-6999BIVOCOM TR321 Wireless Setting cross site scriptingBIVOCOM TR321
- CVE-2026-6998BDCOM P3310D New RMON Statistics cross site scriptingBDCOM P3310D
- CVE-2026-6997BDCOM P3310D New RMON History cross site scriptingBDCOM P3310D
- CVE-2026-6996BDCOM P3310D rmon event Tab cross site scriptingBDCOM P3310D
- CVE-2026-6995BDCOM P3310D New User index.asp cross site scriptingBDCOM P3310D
- CVE-2026-6994Envoy Query Parameter header_mutation.cc params.add injectionEnvoy
- CVE-2026-6993go-kratos http.DefaultServeMux Fallback server.go NewServer confused deputygo-kratos kratos · github.com/go-kratos/kratos/v2
- CVE-2026-6991colinhacks Zod CUID Data Type regexes.ts sql injectioncolinhacks Zod
- CVE-2026-6990projeto-siga novo cross site scriptingprojeto-siga siga
- CVE-2026-6989Tenda F453 Telnet Service telnet TendaTelnet command injectionTenda F453
- CVE-2026-6987PicoClaw Web Launcher Management Plane restart command injectionPicoClaw · github.com/sipeed/picoclaw
- CVE-2026-6986Cesanta Mongoose GCM Authentication Tag tls_aes128.c mg_aes_gcm_decrypt signature verificationCesanta Mongoose
- CVE-2026-6985Cesanta Mongoose TCP Option net_builtin.c handle_opt infinite loopCesanta Mongoose
- CVE-2026-6984AstrBotDevs AstrBot Dashboard API t2i.py create_template special elements used in a template engineAstrBotDevs AstrBot · astrbot
- CVE-2026-6983pagekit download server-side request forgerypagekit
- CVE-2026-6982star7th ShowDoc API Page Sort Endpoint PageController.class.PHP sql injectionstar7th ShowDoc · showdoc/showdoc
- CVE-2026-6981IhateCreatingUserNames2 AiraHub2 Endpoint AiraHub.py sync_agents server-side request forgeryIhateCreatingUserNames2 AiraHub2
- CVE-2026-6980Divyanshu-hash GitPilot-MCP main.py repo_path command injectionDivyanshu-hash GitPilot-MCP
- CVE-2026-6979devlikeapro WAHA API Request media.controller.ts server-side request forgerydevlikeapro WAHA
- CVE-2026-6978JiZhiCMS addcache.html htmlspecialchars_decode sql injectionJiZhiCMS
- CVE-2026-6977vanna-ai vanna Legacy Flask API improper authorizationvanna-ai vanna
- CVE-2026-31684net: sched: act_csum: validate nested VLAN headersLinux
- CVE-2026-31681netfilter: xt_multiport: validate range encoding in checkentryLinux
- CVE-2026-31677crypto: af_alg - limit RX SG extraction by receive buffer budgetLinux